Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

481–490 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#481

Post by [deleted] »

lokedhs wrote: post #64
murphy1312 wrote: post #49

Earlier quoted context omitted.

yes it is. someone has to give you a certificate which the users browser accepts. even if its free today. lets say a simple website which someone uses to display some holiday pictures. why would we need https here, if there is no login or anything like that? it just adds an extra hurdle for not so tech-savvy users and increases the trend to abolish small private websites.

I don't know. Let's say that some non-technical family member goes to this site intending to look at vacation pictures. Imagine if those pictures have been replaced by something else. If you can't think of a long list of replacement images that could be very useful for a spearphishing attack, then you're not having enough imagination. This attack could also be used to get the poster of the photos in trouble.

[deleted]

Re: Firefox 83 introduces HTTPS-Only Mode

#482

Post by CamperBob2 »

hsbauauvhabzb wrote: post #427
dingaling wrote: post #174

Earlier quoted context omitted.

> Alice should either host her photos on Instagram, or learn how to run letsencrypt. Both leading to further centralisation of the Internet. > by providing installers to inject CAs into system cert stores That's already pointless on Android, user-installed CAs are ignored by default unless an app developer opts in to using them. Once we go down this path there's no turning back to the user-centric Web of the 1990s /…

> That's already pointless on Android, user-installed CAs are ignored by default unless an app developer opts in to using them. And? App developers should opt in to ignoring transport security. I’m sure a bunch of Android shitware attempts to install CAs either via user interaction or exploitation. > Once we go down this path there's no turning back to the user-centric Web of the 1990s / 2000s The landscape we live i…

The web is now a multi billion trillion dollar industry.

Maybe your web service is, but mine isn't. Mine is a specialized embedded device server that now has an expiration date for no reason on God's green earth.

Re: Firefox 83 introduces HTTPS-Only Mode

#483

Post by Ajedi32 »

gambler wrote: post #244
jorl17 wrote: post #188

Earlier quoted context omitted.

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…

Funny how "security experts" here complain about accidental non-repudiation misfeature of DKIM, but apparently being forced to do a bunch of crazy crap HTTPS forces you to do when all you need is content signature verification is perfectly fine with those same people. Security is becoming a field dominated by some bizarre corporate ideology.

Doing content signature verification securely would require all the same "crazy crap" that HTTPS does (certificates, CAs, OCSP, ACME, etc). The PKI is the hard part; once you have that there's very little reason not to encrypt as well as sign.

Re: Firefox 83 introduces HTTPS-Only Mode

#484

Post by CamperBob2 »

rakoo wrote: post #73
murphy1312 wrote: post #49

Earlier quoted context omitted.

yes it is. someone has to give you a certificate which the users browser accepts. even if its free today. lets say a simple website which someone uses to display some holiday pictures. why would we need https here, if there is no login or anything like that? it just adds an extra hurdle for not so tech-savvy users and increases the trend to abolish small private websites.

As a visitor to the website, how can I be sure it's only holiday pictures ? If I get to your friendly website and it asks me for private information, and I'm willing to give it because I trust you, what tells me only you will receive it ? How do I know it's your holiday pictures, and not some scam someone else wants to trick me into ?

Here's a novel idea: how about popping up scary warnings when an insecure site asks for information, as opposed to if the insecure site merely exists?

Static content does not need https unless there are reasons for privacy or MiTM concerns related to the nature of the content itself.

Re: Firefox 83 introduces HTTPS-Only Mode

#485

Post by CamperBob2 »

ubercow13 wrote: post #128
murphy1312 wrote: post #49

Earlier quoted context omitted.

yes it is. someone has to give you a certificate which the users browser accepts. even if its free today. lets say a simple website which someone uses to display some holiday pictures. why would we need https here, if there is no login or anything like that? it just adds an extra hurdle for not so tech-savvy users and increases the trend to abolish small private websites.

Of all the parts invloved in setting up a web server, is adding a letsencrypt a significant further barrier? In what situation would a non-tech-savvy user ever be doing that in the first place?

Hint: not all web servers run inside Facebook or Google or Amazon data centers. Some of them run inside individual devices, which will now end up in the landfill once their certificates expire. Many such devices were, and are, just fine running plain old HTTP, but now they're all going to be subject to service life limits imposed by a third-party authority.

This is not how this was supposed to work. This is not how any of this was supposed to work. But it's hard to voice any objections over the proverbial thunderous applause.

Re: Firefox 83 introduces HTTPS-Only Mode

#486

Post by lmm »

akerl_ wrote: post #347
zrm wrote: post #251

Earlier quoted context omitted.

> A slightly less trivial solution where you grab the IP out of a file over HTTP instead could be easily implemented by any junior developer. Over HTTP from what? You would need name resolution or a hard-coded IP address to make an HTTP request. And the thing this is preventing isn't just what the malware does after you're already infected, it's the path to receiving malware to begin with.

GitHub, PyPi, NPM, etc are all great options for hosting dynamic content from a fixed location which looks benign to scanning. For non-tech companies, replace with any relatively popular wiki. The goal is “make a connection over HTTPS or other normal-looking protocol, to a destination that is both justifiability relevant for normal user traffic and allows the attacker to seed the next-step”. And it turns out there ar…

> GitHub, PyPi, NPM, etc are all great options for hosting dynamic content from a fixed location which looks benign to scanning.

They're not going to leave malware payloads sitting there. Pastebins etc. get abused as malware command-and-control systems all the time, and of course some gets through, but countermeasures happen. Whereas for a DoH server it would be operating as designed.

Re: Firefox 83 introduces HTTPS-Only Mode

#487

Post by lmm »

Barrin92 wrote: post #426
Karunamon wrote: post #272

Earlier quoted context omitted.

Because now almost every Firefox user will be sending their DNS straight to one centralized provider, a large corporation, which makes them more vulnerable to various kinds of government interference.

No offence, but how is that more centralised than all of your traffic being plainly visible to your ISP, which in many countries cooperate fairly closely with law enforcement and government, if they're not straight up government owned depending on what country you're in? For example in the UK, a fairly liberal country, DoH still is very useful to avoid countless of the ISP level content blocking that happens, not to…

There are dozens or hundreds of competing ISPs. In the UK I certainly trust A&A a lot more than Cloudflare (who among other things are the #1 provider of fake HTTPS endpoints that send all your data in plaintext across the public internet).

Re: Firefox 83 introduces HTTPS-Only Mode

#488

Post by CamperBob2 »

gambler wrote: post #244
jorl17 wrote: post #188

Earlier quoted context omitted.

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…

Funny how "security experts" here complain about accidental non-repudiation misfeature of DKIM, but apparently being forced to do a bunch of crazy crap HTTPS forces you to do when all you need is content signature verification is perfectly fine with those same people. Security is becoming a field dominated by some bizarre corporate ideology.

True. Take away 20 or so of their IQ points, and the same people would be working for Uncle Sam, groping travelers at the airport.

Re: Firefox 83 introduces HTTPS-Only Mode

#489

Post by stonecharioteer »

aeturnum wrote: post #356
stonecharioteer wrote: post #354

Earlier quoted context omitted.

I've seen this said in several spots and I am curious. Could you point me to a resource that teaches me how to do this with a HTTP website please? I have no experience in doing this and am very interested to learn. Thanks in advance!

The answer to your question will depend on the set of technologies that you are using, but a great place to start is the EFF's Certbot[1]. Certbot will, for many common web servers, verify your servers' domain address and install a cert that will work for ~3 months. It's free and mostly automated. I've been getting certs for all of my side projects and it takes about ~10 minutes each. Highly recommend. [1] https://ce…

Oh wait I didn't out across what I wanted. I meant how do I do a simple "attack" on a http website that's at a mall as OP said. I know how to use certbot for the certificates, (thank you Digital Ocean docs).

I was wondering. If I run a simple http page on my home network, how can I, from another device, change it or make another client get a modified page with the same address?

Re: Firefox 83 introduces HTTPS-Only Mode

#490

Post by romwell »

dewey wrote: post #79
jevgeni wrote: post #66

Earlier quoted context omitted.

It obviously is. Having just an HTML site now becomes more expensive for no clear reason. Which makes more sense for people to check out Gemini.

What makes it more expensive? A certificate is free (With LE or self-signed), the performance impact is negligible and there's a clear reason for why everyone should be using it.

Not everyone needs HTTPS, in spite of what the HN mantra says.

Some websites are the equivalents of billboards.

The cost is dependence on a central authority that can make your site inaccessible in a whim.

Post reply on HN